Assign Delegated Print Administrator and Printer Permission Settings in Windows Server 2012

Applies To: Windows Server 2012

Planning security for your print servers and determining how to restrict access to them is an important part of print server administration. In Windows Vista® and Windows Server® 2008, only full system administrators were able to perform print administrative tasks. In Windows Server 2008 R2 and Windows Server 2012, you can delegate print management tasks directly to users who are not system administrators. You can also define default printer security settings that are inherited when you add new printers to your print server.

These changes enable the following improvements for printer and print server administration:

• You can control access to resources and balance workloads by delegating specific print administrative tasks to users without adding them to the Administrators security group.

• You can manage permission settings through the improved user interface of the Security tab in the Print Server Properties dialog box.

• You can manage your printer infrastructure by configuring default printer security settings which new printers inherit automatically when you add them. You can configure the settings per server so that you do not have to configure the printers individually.

Configuring security settings

This section covers the following:

• The print server security user interface

• Setting permissions in Print Server Properties

• Creating a delegated print administrator

• Print-related permissions and the tasks they enable

• Designing and creating print security groups

The print server security user interface

In Windows Server 2012, users in the Administrators group can configure the print security settings directly by editing the print server access control list (ACL) permissions in the Print Management Microsoft Management Console (MMC) snap-in. (To view the ACL permissions for your printer server, open Server Manager, click Tools, and then click Print Management. In the left pane, click Print Servers, right-click the applicable print server and then click Properties. In the Print Server Properties dialog box, click the Security tab.)

Figure 1 shows the user interface of the Security tab that is opened by a user who is a member of the Administrators group.

Figure 1: Print Server Properties Security tab

In a domain, members of the Administrators group can remotely configure the print server security settings. You can do this by using the Print Management snap-in. The remote functionality for users to view the print server security user interface is supported for certain earlier operating systems, including Windows Server 2008, Windows Vista with SP1, and Windows Vista with SP2. However, the delegated print administrator functionality is currently only available on Windows Server 2008 R2 and Windows Server 2012.

Setting permissions in Print Server Properties

Print server permissions control the levels of access for users on a particular print server. Printer permissions control which printing tasks users can perform on newly added printers that are managed by the print server. Administrators should assign these permissions as needed to users who are not system administrators.

After an administrator customizes the security settings for the print server, all newly added printers to this print server automatically inherit these security settings. (The security settings for the existing printers on the server are not altered.)

The two levels of print server permissions are:

• View Server

  The View Server permission assigns the ability to view the print server. Without the View Server permission, users cannot see the printers that are managed by the server. By default, this permission is given to members of the Everyone group.

• Manage Server

  The Manage Server permission assigns the ability to create and delete print queues (with already installed drivers), add or delete ports, and add or delete forms. A standard user with this permission is called a “delegated print administrator.”

  Note

  Only users who have Manage Server access and are members of the Administrators group can add printer drivers.

The three levels of printer permissions are:

• Print

  The Print permission assigns the ability for users to connect to printers and to print, pause, resume, start, and cancel their own documents. By default, this permission is given to members of the Everyone group when a print queue is created.

• Manage Documents

  The Manage Documents permission assigns the ability to control job settings for all documents and to pause, restart, and delete all documents.

• Manage Printers

  The Manage Printer permission assigns the ability to pause and restart the printer, change spooler settings, share a printer, adjust printer permissions, and change printer properties.

The ability to assign access to a printer on a per-user or a per-group basis makes it possible to manage printers from a central location. For example, an administrator could limit access to a printer in a public area while managing the printer from a more secure, central location.

In Windows Server 2012, the default print server and printer security settings are as follows:

Creating a delegated print administrator

Members of the Administrators group can create a full delegated print administrator by assigning the Manage Server permission to a user. When the Manage Server permission is assigned, the View Server permission is also automatically assigned. You can also delegate a subset of these permissions to create a partial delegated print administrator.

To create a full delegated print administrator

1. Open Server Manager, click Tools, and then click Print Management.

   In the left pane, click Print Servers, right-click the applicable print server, and then click Properties.

   In Print Server Properties, click the Security tab.

2. To configure permissions for a new group or user, click Add. Type the name of the group or user that you want to set permissions for by using the following format: domain name\username. Click OK to close the dialog box.

   Tip

   Before adding any printers to the server, you should create a group of users who can perform delegated print tasks, and then configure the proper permissions. If you do this, all newly added printers automatically inherit these settings, and you do not have to individually configure existing printers for the print server.

3. Highlight the user or group name that you just added, and in Permissions for <user or group name>, click Allow for the Manage Server permission. (The View Server permission is assigned too.)

4. Select the Allow check boxes for the Print, Manage Documents, and Manage Printers permissions.

To create a partial delegated print administrator

• To enable an administrator to add printers:

  Follow the previous instructions, but select the Allow check boxes for the Manage Server and Print permissions. (View Server permission is assigned automatically too.)

• To enable an administrator to manage existing print queues:

  Follow the previous instructions, but select the Allow check boxes for the View Server, Print, Manage Documents, and Manage Printer permissions.

Print-related permissions and the tasks they enable

The following table lists the print tasks that a user can perform when assigned the corresponding permissions from the Print Server Properties Security tab.

Designing and creating print security groups

Following is a list of suggested print security groups and their associated permissions:

• System Administrators Group: Consists of members of the Administrators security group.

• Print Administrators Group: Consists of members of the System Administrators group and users who have been assigned some set of delegated print administrator rights. Depending on what rights you assign, members of this group may be considered full delegated administrators or partial delegated administrators.

The following table demonstrates which actions can be performed depending on the permissions assigned:

For more information about Windows PowerShell Print Management cmdlets, see Print Management Cmdlets in Windows PowerShell.